Partner Abigail Healey, Associate Grace Cullinane and Paralegal Lucia Cipolat examine the privacy rights of regulatory targets

Partner Abigail Healey, Associate Grace Cullinane and Paralegal Lucia Cipolat consider the extent to which the ruling in Bloomberg LP v ZXC, which established that suspects under criminal investigation have a right to privacy, extends to regulatory investigations, including those which are non-criminal in nature.

Abigail, Grace and Lucia’s article was published in Thomson Reuters Regulatory Intelligence, 18 July 2025, and can be found here.

Since the Supreme Court’s decision in Bloomberg LP v ZXC, there can be no doubt that individuals under criminal investigation have a reasonable expectation of privacy, unless and until charges are brought. That right to privacy extends to investigations by state investigatory bodies, such as the National Crime Agency (NCA) and Serious Fraud Office (SFO), as well as police investigations.

In this article, we look at the position in relation to those under investigation by regulatory bodies more generally, particularly in light of the recent volte face by the Financial Conduct Authority’s (FCA), which in March 2025 announced it was abandoning its proposal for increasing transparency in relation to its investigations.

Bloomberg LP v ZXC – Privacy of Suspects

ZXC is the leading authority on the privacy rights of individuals under criminal investigation.  The court reaffirmed the established two-stage test for misuse of private information:

• Stage 1 asks whether the claimant has a reasonable expectation of privacy in the information.
• Stage 2 balances that privacy interest against the publisher’s Article 10 rights i.e. whether the public interest in disclosure outweighs that expectation.

The court held that individuals under criminal investigation do have a reasonable expectation of privacy – particularly given the reputational harm that premature identification can cause.  Unless and until charges are brought, the balance tips in favour of confidentiality.  Specifically, the court held that “in general, a person under criminal investigation has, prior to being charged, a reasonable expectation of privacy” in respect of information relating to that investigation.

The judgment underscored the policy rationale: law enforcement agencies and regulators usually do not name suspects during ongoing investigations.  The court described a “uniform general practice” of not identifying individuals before they are charged, citing the risk of “unfair damage to reputation” and other harms.

FCA Enforcement Transparency Proposals

In February 2024, the FCA consulted on new rules aimed at increasing transparency around enforcement investigations. One key proposal was to replace the current “exceptional circumstances” threshold for publicly identifying firms under investigation with a broader “public interest” test.

Currently, the FCA announces investigations only in exceptional circumstances (and in practice has rarely done so) – specifically, when it is desirable to:

• maintain public confidence in the financial system or the market;
• protect consumers or investors;
• prevent widespread malpractice;
• help the investigation itself e.g. by bringing forward witnesses; or
• maintain the smooth operation of the market.

The proposed “public interest” test would have required the FCA to weigh up all the circumstances and would have removed the presumption of confidentiality for firms under investigation. Even if individuals are not named but the firm is, there is of course an attendant risk that identification of involved individuals would be possible.

However, in March 2025, the FCA confirmed it would not adopt this proposal due to a “lack of broad consensus.”

Its June 2025 update to the Enforcement Guide confirmed that the existing “exceptional circumstances” threshold will continue to apply to regulated firms.

Applying ZXC to Regulatory Investigations

As noted above, ZXC would apply in the context of investigations by state investigatory bodies such as the NCA and SFO. There are, however, many other regulators which may have limited – or no – state investigatory powers. HM Revenue & Customs (HMRC), for instance, is responsible for investigating tax-related criminal offences and has investigatory powers and would plainly be caught by ZXC in that respect. Only certain HMRC officers are, however, authorised to use criminal investigatory powers and much of HMRC’s work does not relate to investigating potential criminal offences. HMRC’s Personal Information Charter sets out the standards a taxpayer can expect from HMRC in terms of keeping information confidential.

There are certain professional regulatory bodies which also have state-derived investigatory powers, such as the General Medical Council (GMC). Others, such as the Institute of Chartered Accountants of England and Wales (ICAEW), do not have state investigatory powers but do have a robust regulatory and disciplinary role, with the power to investigate potential misconduct derived from their self-regulated status. It is entirely conceivable that the misconduct under investigation by those professional bodies may also amount to a criminal offence. It would be absurd if individuals under such investigation did not have a reasonable expectation of privacy in relation to the non-criminal investigation in those circumstances.

In Sicri v ANL, the court held that the right to privacy is afforded to those who have come “under suspicion by the state”. There is at least an argument that that suggests something wider than purely criminal investigations.

Fairness to those under investigation is paramount.  The premise of ZXC is clear: premature publicity can cause irreversible damage.  Unfounded suspicion can be as damaging as guilt. Any regulatory investigation – whether of conduct which could potentially amount to a criminal offence or not – can inflict irreparable reputational harm.  It is welcome news that the FCA appears to acknowledge this when abandoning the proposed introduction of the public interest test to naming firms under investigation.

Any individual who is the subject of a regulatory investigation should have a reasonable expectation that the fact that they are under investigation and the details thereof should be kept private, at least until the outcome of the investigation is known. ZXC makes clear that in a criminal investigation, the subject has a right to privacy unless and until they are charged, the implication being that if they are not charged, the investigation should remain confidential.

By analogy, in the context of investigations which are not criminal in nature, the subject should have a right to privacy until the investigation is concluded. If there is found to be no case to answer, then the right to privacy remains.

When Privacy Prevails – and When It Does Not

Applying ZXC, the starting point is that those under regulatory investigation should have a reasonable expectation of privacy. The second stage of ZXC, however, requires a balancing exercise to be undertaken between that right to privacy and the publisher’s article 10 rights and whether the publication would be in the public interest. If there is a clear public-interest justification, such as preventing harm to consumers or markets, that may still prevail.

Implications

For individuals under regulatory investigation, ZXC provides a valuable legal safeguard.  It affirms that they may assert privacy rights against premature exposure unless and until formal charges or findings are made.  The FCA’s decision to retain its cautious naming policy reflects this principle. Ultimately, ZXC sends a clear message: the identities of those under investigation should remain private unless public disclosure is demonstrably necessary.